Tongsuo
Tongsuo copied to clipboard
Avoid type errors in EAI-related name check logic.
The incorrectly typed data is read only, used in a compare operation, so neither remote code execution, nor memory content disclosure were possible. However, applications performing certificate name checks were vulnerable to denial of service.
The GENERAL_TYPE data type is a union, and we must take care to access the correct member, based on gen->type
, not all the member fields have the same structure, and a segfault is possible if the wrong member field is read.
The code in question was lightly refactored with the intent to make it more obviously correct.
Fixes CVE-2024-6119
Checklist
- [ ] 在 https://yuque.com/tsdoc 增加或更新了必要的文档
- [ ] 增加或更新了必要的测试用例
- [ ] 对于重要修改,更新了CHANGES文件
- [ ] 当前修改存在对已有API参数或返回值的改变
- [ ] 当前修改存在对旧版本功能的兼容性改变(如网络协议或密码算法)